---
name: "audit_set_failure"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audit_set_failure"
---

# audit\_set\_failure(3)

Set audit failure flag

## NAME

audit\_set\_failure - Set audit failure flag

## SYNOPSIS

**#include \<libaudit.h\>**

**int audit\_set\_failure(int***fd,***uint32\_t"***failure);"*

## DESCRIPTION

audit\_set\_failure sets the action that the kernel will perform when the backlog limit is reached or when it encounters an error and cannot proceed. Possible values are:

- 0 - AUDIT\_FAIL\_SILENT

  Do nothing, report nothing, skip logging the record and continue.

- 1 - AUDIT\_FAIL\_PRINTK \[default\]

  Log the audit record using printk which will cause subsequent events to get written to syslog.

- 2 - AUDIT\_FAIL\_PANIC

  Call the panic function. This would be used to prevent use of the machine upon loss of audit events.

## RETURN VALUE

The return value is \<= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that sendto would encounter.

## SEE ALSO

[**audit\_set\_backlog\_limit**(3)](/audit_set_backlog_limit/3.md), [**audit\_open**(3)](/audit_open/3.md), [**auditd**(8)](/auditd/8.md), [**auditctl**(8)](/auditctl/8.md).

## AUTHOR

Steve Grubb